kenmirrors/grocy
1
0
Fork 0
mirror of https://github.com/grocy/grocy.git synced 2025-08-15 10:14:39 +00:00
Code Issues Projects Releases Wiki Activity

Sanitize user input on all API routes (references #996)

Browse Source
This commit is contained in:
Bernd Bestel
2020-10-14 22:49:29 +02:00
parent 7b8438bfa2
commit c11001467b
12 changed files with 98 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
controllers/UsersApiController.php
View File

@@ -11,7 +11,7 @@ class UsersApiController extends BaseApiController
try
{
User::checkPermission($request, User::PERMISSION_ADMIN);
$requestBody = $request->getParsedBody();
$requestBody = $this->GetParsedAndFilteredRequestBody($request);
$this->getDatabase()->user_permissions()->createRow([
'user_id' => $args['userId'],
@@ -32,7 +32,7 @@ class UsersApiController extends BaseApiController
public function CreateUser(\Psr\Http\Message\ServerRequestInterface $request, \Psr\Http\Message\ResponseInterface $response, array $args)
{
User::checkPermission($request, User::PERMISSION_USERS_CREATE);
$requestBody = $request->getParsedBody();
$requestBody = $this->GetParsedAndFilteredRequestBody($request);
try
{
@@ -75,7 +75,7 @@ class UsersApiController extends BaseApiController
User::checkPermission($request, User::PERMISSION_USERS_EDIT);
}
$requestBody = $request->getParsedBody();
$requestBody = $this->GetParsedAndFilteredRequestBody($request);
try
{
@@ -152,7 +152,7 @@ class UsersApiController extends BaseApiController
try
{
User::checkPermission($request, User::PERMISSION_ADMIN);
$requestBody = $request->getParsedBody();
$requestBody = $this->GetParsedAndFilteredRequestBody($request);
$db = $this->getDatabase();
$db->user_permissions()
->where('user_id', $args['userId'])
@@ -186,7 +186,7 @@ class UsersApiController extends BaseApiController
{
try
{
$requestBody = $request->getParsedBody();
$requestBody = $this->GetParsedAndFilteredRequestBody($request);
$value = $this->getUsersService()->SetUserSetting(GROCY_USER_ID, $args['settingKey'], $requestBody['value']);
return $this->EmptyApiResponse($response);